f334ce1f108f119229a9b9c386999ad5929411ff001d6d50535650beae4a02ce

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12-05-2024 03:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

38233ae781394216fab208c46176e240_JaffaCakes118.html
Size

19KB
MD5

38233ae781394216fab208c46176e240
SHA1

3656de5ee301529f913514cbdbed415e0c34e588
SHA256

f334ce1f108f119229a9b9c386999ad5929411ff001d6d50535650beae4a02ce
SHA512

5c0fe013eb4e87b12a7fae4737b868c6ad847e9fa5595b7abae4ef5402a20c61f2b828bdd2772ef4512abcb70522071d66f37d44393a6bc42a150503d624905f
SSDEEP

384:Dwo1Uzwwa0/LAvQgbsuufWzlzHA7Uv9zzfFzSBbiq6ciq6Z:so1Uzr/LAvQgb80AO9ffFciqfiqo

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
508	msedge.exe
508	msedge.exe
740	msedge.exe
740	msedge.exe
4212	identity_helper.exe
4212	identity_helper.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 740 wrote to memory of 1440	740	msedge.exe	82
PID 740 wrote to memory of 1440	740	msedge.exe	82
PID 740 wrote to memory of 4032	740	msedge.exe	83
PID 740 wrote to memory of 4032	740	msedge.exe	83
PID 740 wrote to memory of 4032	740	msedge.exe	83
PID 740 wrote to memory of 4032	740	msedge.exe	83
PID 740 wrote to memory of 4032	740	msedge.exe	83
PID 740 wrote to memory of 4032	740	msedge.exe	83
PID 740 wrote to memory of 4032	740	msedge.exe	83
PID 740 wrote to memory of 4032	740	msedge.exe	83
PID 740 wrote to memory of 4032	740	msedge.exe	83
PID 740 wrote to memory of 4032	740	msedge.exe	83
PID 740 wrote to memory of 4032	740	msedge.exe	83
PID 740 wrote to memory of 4032	740	msedge.exe	83
PID 740 wrote to memory of 4032	740	msedge.exe	83
PID 740 wrote to memory of 4032	740	msedge.exe	83
PID 740 wrote to memory of 4032	740	msedge.exe	83
PID 740 wrote to memory of 4032	740	msedge.exe	83
PID 740 wrote to memory of 4032	740	msedge.exe	83
PID 740 wrote to memory of 4032	740	msedge.exe	83
PID 740 wrote to memory of 4032	740	msedge.exe	83
PID 740 wrote to memory of 4032	740	msedge.exe	83
PID 740 wrote to memory of 4032	740	msedge.exe	83
PID 740 wrote to memory of 4032	740	msedge.exe	83
PID 740 wrote to memory of 4032	740	msedge.exe	83
PID 740 wrote to memory of 4032	740	msedge.exe	83
PID 740 wrote to memory of 4032	740	msedge.exe	83
PID 740 wrote to memory of 4032	740	msedge.exe	83
PID 740 wrote to memory of 4032	740	msedge.exe	83
PID 740 wrote to memory of 4032	740	msedge.exe	83
PID 740 wrote to memory of 4032	740	msedge.exe	83
PID 740 wrote to memory of 4032	740	msedge.exe	83
PID 740 wrote to memory of 4032	740	msedge.exe	83
PID 740 wrote to memory of 4032	740	msedge.exe	83
PID 740 wrote to memory of 4032	740	msedge.exe	83
PID 740 wrote to memory of 4032	740	msedge.exe	83
PID 740 wrote to memory of 4032	740	msedge.exe	83
PID 740 wrote to memory of 4032	740	msedge.exe	83
PID 740 wrote to memory of 4032	740	msedge.exe	83
PID 740 wrote to memory of 4032	740	msedge.exe	83
PID 740 wrote to memory of 4032	740	msedge.exe	83
PID 740 wrote to memory of 4032	740	msedge.exe	83
PID 740 wrote to memory of 508	740	msedge.exe	84
PID 740 wrote to memory of 508	740	msedge.exe	84
PID 740 wrote to memory of 2308	740	msedge.exe	85
PID 740 wrote to memory of 2308	740	msedge.exe	85
PID 740 wrote to memory of 2308	740	msedge.exe	85
PID 740 wrote to memory of 2308	740	msedge.exe	85
PID 740 wrote to memory of 2308	740	msedge.exe	85
PID 740 wrote to memory of 2308	740	msedge.exe	85
PID 740 wrote to memory of 2308	740	msedge.exe	85
PID 740 wrote to memory of 2308	740	msedge.exe	85
PID 740 wrote to memory of 2308	740	msedge.exe	85
PID 740 wrote to memory of 2308	740	msedge.exe	85
PID 740 wrote to memory of 2308	740	msedge.exe	85
PID 740 wrote to memory of 2308	740	msedge.exe	85
PID 740 wrote to memory of 2308	740	msedge.exe	85
PID 740 wrote to memory of 2308	740	msedge.exe	85
PID 740 wrote to memory of 2308	740	msedge.exe	85
PID 740 wrote to memory of 2308	740	msedge.exe	85
PID 740 wrote to memory of 2308	740	msedge.exe	85
PID 740 wrote to memory of 2308	740	msedge.exe	85
PID 740 wrote to memory of 2308	740	msedge.exe	85
PID 740 wrote to memory of 2308	740	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\38233ae781394216fab208c46176e240_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdb7d346f8,0x7ffdb7d34708,0x7ffdb7d34718
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1944,14564645977897015193,10110339852758933385,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1944,14564645977897015193,10110339852758933385,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1944,14564645977897015193,10110339852758933385,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,14564645977897015193,10110339852758933385,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,14564645977897015193,10110339852758933385,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,14564645977897015193,10110339852758933385,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1944,14564645977897015193,10110339852758933385,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5364 /prefetch:8
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1944,14564645977897015193,10110339852758933385,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5364 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,14564645977897015193,10110339852758933385,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,14564645977897015193,10110339852758933385,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,14564645977897015193,10110339852758933385,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,14564645977897015193,10110339852758933385,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1944,14564645977897015193,10110339852758933385,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2632 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5000

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:392

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
389B

MD5
fe30829cebd41417ca2262febe00b103

SHA1
38ae43e88ca869a803b50a0c42e4597b7e53c4a1

SHA256
c952b1f0e9d31f2dc9f2628007375d8f6e69976f4fbc084c828c54fa980f42da

SHA512
915253568de729a83234c7862a9d60c6c869c5f839febae56d5bde13258d06425500f72858f0b31b60006ae10afab50c17c75a8d72b99162c37b05104133cacb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
35388483da1d8bc257c1576f653bc5e2

SHA1
6ba79cb82fadb1ea7f5e584ccc74238a19b507e3

SHA256
6459e1f6928e38e09d2499f2eab6074529221e850a99ee5c936731cdacbc8562

SHA512
04e1170d687fd53b594d07802cc4eefc40c6a030a70f8488c5ad678a2b65a85644a2aafbc427c799a758ddab8959ff69e1d4bb49c8e159b49713c46c5ee37755

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
68862b8c2bd834cf3e463bff0ba3777a

SHA1
ac0b25a42d0c11b9f4fca62425826d2eb1f562ff

SHA256
5be929cb837471fd222b690287c75fb051ba2ebd1b7d81b1c562697eaf1cdb44

SHA512
b96e7d21af1e1ad31cff1a2a9c327279361a5949f8fe2030911a6fe2a9fdbd177f886c368f150523709bcb7cec0ab7b2ba2427a7cef2db8c56a8503ad7dcb661

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
31164dd7ab44261bb7aee5eea5af1e32

SHA1
1f4447281408396a30d6f91476d49672337ddf16

SHA256
5eb917187d89c6926dd6e027768170741f7f731ee8d9e6a108b5babdadc46c82

SHA512
1b77adcf2dda97e5111a1541f8cf16c316cf69ddebc502a2ee09aef25bc92ca20959dbb05823f215e8eed82877da7242651a74a50072e133ac1ccdb069e3023d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57aff7.TMP

Filesize
1KB

MD5
4680e9df7dec03a402e6dabe11216242

SHA1
99332b35b167e78bbd522b6d9a1aad784927b61b

SHA256
e20e2e925140829c050aa86dc644b978f36ad613efb8469a521a9804401e4e35

SHA512
fcb9b9783071a4af760a99a769f93c013a9fdd723f59313ef34f94b5c3312121947bb089d88122fa6316c1041eef1428b0392e78cc0dd0829e2ff195f86faaee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
98d0f172591f0a5899bf8b6d055ee0f3

SHA1
8ce2180741385f7b685012fb6ab415c654a8534b

SHA256
477db05518b38da354112144cd570abb681b75fe298c963bdae318d5c0aa53cd

SHA512
5115bda2b51441e7e4de1846d44620a9b19ba5e81a6ecd674a2519e38d1b2548d4a274aa3c9372e1ed913b4bda219e73ef92b19ca4d271c0aee58cf6f023c9d5

Download Submit